SushiSwap’s Security Breach: Millions Lost in Critical Vulnerability
PeckShield, a security firm, discovered a critical vulnerability in the SushiSwap DeFi protocol this past weekend.
The flaw is related to the “RouterProcessor2” contract utilized for trade routing on the SushiSwap exchange. According to PeckShield, a bug in the contract resulted in over $3.3 million in losses for a single user, known as 0xsifu, who is well-known in the Crypto Twitter community.
It seems the @SushiSwap RouterProcessor2 contact has an approve-related bug, which leads to the loss of >$3.3M loss (about 1800 eth) from @0xSifu.
If you have approved https://t.co/E1YvC6VZsP, please *REVOKE* ASAP!
One example hack tx: https://t.co/ldg0ww3hAN pic.twitter.com/OauLbIgE0Q
— PeckShield Inc. (@peckshield) April 9, 2023
SushiSwap’s head developer, Jared Grey, confirmed the issue and advised users to revoke permissions for all contracts on the platform as a precautionary measure.
Sushi's RouteProcessor2 contract has an approval bug; please revoke approval ASAP. We're working with security teams to mitigate the issue. https://t.co/WhXJfa5xD4
— Jared Grey (@jaredgrey) April 9, 2023
The incident highlighted the need for continued vigilance and security measures in the DeFi ecosystem. The sector remains vulnerable to exploits and attacks targeted at misconfigured accounts.
It is recommended that users revoke permissions for all SushiSwap contracts to safeguard their assets while developers and security teams work to address the vulnerability and recover lost funds.
READ MORE: Ripple’s Lawsuit: New Developments Could Have a Huge Impact
Recovery efforts are underway, with some stolen funds already being returned. The initial attacker, 0x9deff, has returned 90 ETH out of the 100 they stole, and BlockSec has recovered and pledged to return 100 ETH soon.
There are ongoing negotiations between sifuvision.eth and c0ffeebabe.eth, as most of the stolen funds, have been traced to “beaverbuild, rsync-builder, and Lido: Execution Layer Rewards Vault.”
BlockSecTeam acknowledged their involvement in the recovery efforts and tweeted that they had rescued part of the funds and would release details later. It is crucial to note that users should exercise caution and ensure their accounts are properly configured to avoid potential vulnerabilities in the future.
At the time of writing, SUSHI is trading at $1.08 after a 4.9% drop on the daily chart.
Alexander Stefanov
Reporter at CoinsPress
Alex is an experienced finance journalist and a cryptocurrency and blockchain enthusiast. With over five years of experience covering the industry, he deeply understands the complex and constantly evolving world of digital assets. His insightful and thought-provoking articles provide readers with a clear picture of the latest developments and trends in the market. His passionate approach allows him to break down complex ideas into accessible and insightful content. Follow up on his content to be up to date with the most important trends and topics - stay ahead of the curve with CoinsPress.
